Conventional Retaliation and Cyber Attacks

On July 27, 2021, President Joe Biden warned, in a speech at the Office of Director of National Intelligence, that “I think it's more than likely we're going to end up, if we end up in a war - a real shooting war with a major power - it's going to be as a consequence of a cyber breach of great consequence and it's increasing expo­nentially, the capabilities.” Most analysts view the president’s hypothetical scenario as unlikely for two reasons. First, attributing cyberattacks is often challenging, making retaliation difficult, if not im­possible. Cyberattacks are commonly anonymous, hard to trace, and may be triggered long after they were set up. Moreover, they are often carried out not by states but by criminal entities, hacker groups, or other non-state actors, which sometimes but not always are affiliated with or sponsored by states. The practical and political window for overt retalia­tion closes if a cyberattack cannot be directly and timely attributed to a state. Second, and importantly, most cyberattacks do not have strategic effects. The preponderance of cyberat­tacks are either distributed denial-of-service (DDOS) attacks (meant to disrupt, blackmail, or extort), or they are efforts to collect information through a combination of hacking and malware. Even attacks attributable to a state usually fall below the threshold for conven­tional retaliation. Yet we explain here why improvements in attribution capabilities, combined with cyberattacks’ increasing potential to kill people, threaten military readiness, and wreak economic destruction are making it more likely that a cyberattack will trigger a conventional response. This is significant because, as foreseen by President Biden, it means that a cyberattack could be not only an element of war but a precipitating act of war. This article summarizes how some states already anticipate this possibility, and reviews the conventional wisdom on the relationship among cyberattacks, retaliation, and escalation, with special attention to attribution. We then show accurate attribution is easier now, and that cyberattacks with strategic impact are somewhat more likely. We conclude with recommendations for considering this new level of cyber conflict.